Free AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 – Amazon AWS-CERTIFIED-SECURITY-SPECIALTY-SCS-C02 Practice Test Question

Loading demo links...

Showing 25–27 of 31 questions

Question 25 (Topic 1)

A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80. The ALB is in public subnets that are associated with a network ACL that is named NACL1. The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL that is named NACL3. All the network ACLs currently allow all inbound and outbound traffic. Which set of network ACL changes will increase the security of the application while ensuring functionality?

Select an option, then click Submit answer.

○ Make the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from NACL2. • Add a rule that allows outbound traffic on ports 1024-65536 to NACL2. • Remove the default rules that allow all inbound and outbound traffic.
○ Make the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from the Cl DR blocks of the application instance subnets. • Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets. • Remove the default rules that allow all inbound and outbound traffic.
○ Make the following changes to NACL2: • Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets. • Remove the default rules that allow all inbound and outbound traffic.
○ Make the following changes to NACL2: • Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets. • Add a rule that allows outbound traffic on port 5432 to the RDS subnets.

Reference / correct answer:

Make the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from the Cl DR blocks of the application instance subnets. • Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets. • Remove the default rules that allow all inbound and outbound traffic.

Most accepted answer: B. Make the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from the Cl DR blocks of the application instance subnets. • Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets. • Remove the default rules that allow all inbound and outbound traffic.

Community votes: B=3, C=1

Selected Answer: B A: Referencing NACL2 (instead of CIDR blocks) is invalid—NACL rules require IP ranges, not ACL identifiers. C/D: Modifying NACL2 (application subnet) is unnecessary here. The ALB already forwards traffic to port 80 on the EC2 instances, which is managed by security groups. NACL2’s default allow-all rules are already sufficient for ALB-to-EC2 traffic. upvoted 2 times

Selected Answer: B Why is B the Best Choice? Restricts Database Access (RDS - NACL3) The RDS instance only needs to accept traffic from the application instances (NACL2) on port 5432 (PostgreSQL). This prevents unauthorized access from other sources. Ensures Proper Response Traffic Flow PostgreSQL replies on ephemeral ports (1024-65536), so outbound traffic from NACL3 to NACL2 must be allowed for the connection to function. Removes Open Access The default allow-all rules are removed, improving security. Only necessary inbound and outbound traffic is permitted. upvoted 2 times

Selected Answer: C Answer is C. By default, AWS creates NACLs that allow all inbound and outbound traffic. To improve security, it is recommended to restrict access to only necessary traffic. There is no need for DB subnet to open a broad range of ports. Another problem with B is, how would you protect the application server if the NACL rule still allows all traffic? The question asked is to protect the application. upvoted 1 times

Selected Answer: B B. database will allow access from/to application subnet only upvoted 2 times

I think B is correct. Inbound 5432 is allowed and outbound for ephemeral ports. Answer A is wrong as you can't use other NACL as a source. upvoted 3 times

Question 26 (Topic 1)

A company hosts an application on Amazon EC2 instances. The application also uses Amazon S3 and Amazon Simple Queue Service (Amazon SQS). The application is behind an Application Load Balancer (ALB) and scales with AWS Auto Scaling. The company's security policy requires the use of least privilege access, which has been applied to all existing AWS resources. A security engineer needs to implement private connectivity to AWS services. Which combination of steps should the security engineer take to meet this requirement? (Choose three.)

Select an option, then click Submit answer.

○ Use an interface VPC endpoint for Amazon SQS.
○ Configure a connection to Amazon S3 through AWS Transit Gateway.
○ Use a gateway VPC endpoint for Amazon S3.
○ Modify the IAM role applied to the EC2 instances in the Auto Scaling group to allow outbound traffic to the interface endpoints.
○ Modify the endpoint policies on all VPC endpoints. Specify the SQS and S3 resources that the application uses.
○ Configure a connection to Amazon S3 through AWS Firewall Manager.

Question 27 (Topic 1)

A company is using an Amazon CloudFront distribution to deliver content from two origins. One origin is a dynamic application that is hosted on Amazon EC2 instances. The other origin is an Amazon S3 bucket for static assets. A security analysis shows that HTTPS responses from the application do not comply with a security requirement to provide an X-Frame-Options HTTP header to prevent frame-related cross-site scripting attacks. A security engineer must make the full stack compliant by adding the missing HTTP header to the responses. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Create a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront origin response event.
○ Create a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront viewer request event.
○ Update the CloudFront distribution by adding X-Frame-Options to custom headers in the origin settings.
○ Customize the EC2 hosted application to add the X-Frame-Options header to the responses that are returned to CloudFront.

← Prev 2 3 4 5 6 7 8 9 10 11 Next →

Page 9 of 11

Sale Ends In

2h 0m 0s